What is the CVSS score of CVE-2026-39729?

CVE-2026-39729 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-39729?

Within 24 hours, inventory every WordPress instance running Edwiser Bridge and identify which are on version 4.3.4 or earlier, prioritizing any that are internet-facing; since no vendor-released patch is identified at time of analysis, place affected sites behind access restrictions (IP allowlisting, VPN, or HTTP authentication) and apply WAF or reverse-proxy rules that block direct external access to the plugin's endpoint paths. Within 7 days, contact the vendor for a fixed release timeline and confirm whether a patched version above 4.3.4 has shipped; if none exists, evaluate removing or deactivating Edwiser Bridge until a fix is available, weigh that against operational dependence on Moodle integration, and enable verbose logging on the plugin's REST and AJAX routes so outbound data exposure can be detected. Within 30 days, complete remediation by upgrading all Edwiser Bridge installations to a vendor-fixed version the moment one is confirmed, verify via re-scan that no instance remains on 4.3.4 or earlier, and, if integration must continue unpatched, document the accepted risk with compensating controls and review network logs retrospectively for anomalous read activity against the plugin.

Edwiser Bridge CVE-2026-39729

EUVD-2026-93251 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-10-06 Patchstack

GHSA-pgmx-6r8f-45xx

WordPress Information Disclosure Edwiser Bridge Wordpress Plugin Wisdmlabs

7.2

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running Edwiser Bridge ≤4.3.4
Exploit

Send unauthenticated request to vulnerable endpoint
Impact

Receive and exfiltrate exposed sensitive data

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Exploitation Conditions	Exploitation requires only that a target WordPress site has the Edwiser Bridge plugin (the WordPress-Moodle integration plugin by WisdmLabs) installed at version 4.3.4 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special privileges, and no user interaction are needed, and no non-default configuration is cited in the description. Limiting factors are therefore primarily deployment-based: the site must run the vulnerable plugin version and expose the affected functionality to the attacker's network path; the narrow, education-focused install base of this plugin further constrains the realistic attack surface. The exact feature or endpoint that leaks data is not specified in the available source data.
Impact	This is a moderate-priority issue rather than an urgent one. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which raises baseline concern for an internet-facing WordPress site. However, several real-world signals are absent or conflicting: no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. Notably, the vendor-supplied CVSS vector is internally inconsistent - it scores C:N/I:L/A:L with Scope:Changed, yet the vulnerability is described as 'Sensitive Data Exposure' and mapped to CWE-201, which is fundamentally a confidentiality weakness; a data-exposure flaw scoring zero confidentiality impact is contradictory and the I:L/A:L/S:C combination appears mislabeled - verify the impact metrics with Patchstack/the vendor. Weighing these together, the absence of KEV, EPSS, and POC data suggests this is not currently a mass-exploited threat, placing it in a 'patch in normal cycle' tier rather than emergency response, with the caveat that the true confidentiality impact may be understated by the provided score.
Exploit ScenarioDerived	A remote attacker sends crafted unauthenticated requests to a WordPress site running Edwiser Bridge 4.3.4 or earlier and retrieves sensitive information (such as Moodle/WordPress integration data or user details) that should not be publicly accessible. Because the CVSS vector shows PR:N and UI:N, no login or victim interaction is needed. No public proof-of-concept was provided in the source data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

Sensitive data exposure in the Edwiser Bridge WordPress plugin, affecting versions up to and including 4.3.4, allows remote attackers to read information the plugin transmits without any authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). The weakness is classified as CWE-201, information exposure through sent data, meaning the plugin emits sensitive values outward rather than verifying that the requester is entitled to them; the assessed impact is loss of confidentiality only, with no integrity or availability effect, and the exact leaking feature or endpoint is not enumerated in the available advisory. This is a moderate-priority issue rather than an urgent one: no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the plugin's narrow, education-sector install base (WordPress sites integrated with Moodle) limits realistic exposure.

RemediationAI

No vendor-released patch is identified at time of analysis and no fixed version number is published in the supplied data, so administrators cannot yet upgrade their way out of this issue; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/edwiser-bridge/vulnerability/wordpress-edwiser-bridge-plugin-4-3-4-sensitive-data-exposure-vulnerability should be monitored for a patched release and the plugin updated immediately when WisdmLabs ships one. Until then, the most reliable compensating control is to deactivate the Edwiser Bridge plugin on any site that does not actively need the WordPress-Moodle integration, accepting that this breaks enrollment and user synchronization between the two systems; sites that must keep it running should restrict network access to the plugin's endpoints - blocking direct internet access to the plugin's PHP files and admin-ajax/REST routes at the web server or WAF layer and permitting only trusted Moodle server IP addresses - with the trade-off that legitimate Moodle callbacks or remote enrollment workflows originating from other addresses will fail. Additional hardening includes enabling verbose logging on requests to the plugin's routes to detect enumeration attempts, and applying virtual patching through a WAF that filters sensitive fields from the plugin's outbound responses if a suitable rule is available, recognizing that such rules are brittle because the exact leaking parameter is not documented.

Affected VersionsENISA

Edwiser Bridge n/a ≤4.3.4

Affected Packages

euvd edwiser_bridge no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Edwiser Bridge is a WordPress plugin from WisdmLabs that bridges a WordPress site with a Moodle learning-management installation, synchronizing users, enrollments, and course data between the two systems. The CPE fingerprint cpe:2.3:a:wisdmlabs:edwiser_bridge:*:*:*:*:*:*:*:* confirms the affected component is the plugin itself rather than the WordPress core or the Moodle platform. CWE-201 (Information Exposure Through Sent Data) describes the root-cause class: sensitive information is included in data the component sends outbound - for example in an API response, AJAX handler reply, or generated payload - without adequate authorization or filtering, so anyone who can reach that functionality receives the data. Reported by Patchstack, the flaw sits in the plugin's exposed request-handling surface rather than in a stored-content or privilege-escalation path. Because the CVSS vector specifies PR:N, there is no requirement for the attacker to hold a WordPress account, be enrolled in a course, or possess any special role; UI:N additionally means the victim does not have to click anything. The independent assessment scores scope as unchanged (S:U) with confidentiality impact only (C:L/I:N/A:N), characterizing the outcome as disclosure of limited-scope data rather than a full compromise of the host or its users' credentials.

Know when Edwiser Bridge gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

vuln.today AI 5.3 MEDIUM

Unauthenticated remote data exposure (CWE-201) impacts confidentiality only, so C:L with I:N/A:N and no scope change, correcting the input's contradictory C:N/I:L/A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

Executive ViewAI

Why It Matters

The Edwiser Bridge plugin, which connects WordPress sites to Moodle learning platforms, leaks sensitive information to any remote requester without authentication, affecting all installations up to and including version 4.3.4. Because these sites sit inside educational institutions, exposed data can carry student, credential, or integration-related information that triggers FERPA, GDPR, or contractual breach-notification obligations. The plugin's narrow, education-sector install base and the absence of any observed exploitation make this a manageable exposure rather than a crisis, but unpatched internet-facing instances warrant prompt inventory and containment.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict the plugin's endpoints to trusted networks or authenticated users via WAF, reverse proxy, or IP allowlisting; deactivate or remove Edwiser Bridge where Moodle integration is not business-critical; monitor web and plugin logs for anomalous read requests; and apply the principle of least exposure by removing any sensitive values the plugin transmits unnecessarily.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

Low

niche WordPress-to-Moodle e-learning integration plugin, modest install base

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.